Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
842 detections
Filters
Last updated
All Time
Detection languages
353
266
54
39
37
Contributors
180
133
123
92
66
Categories
504
404
177
164
108
Platforms
827
12
5
3
3
Products / Services
275
213
177
129
40
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
842
CVEs
5
4
2
2
2
IDS Classtypes
1
IDS Protocols
3
Detects the installation and execution of DWAgent (dwagsvc.exe) from the C:\ProgramData directory, specifically looking for service installation and startup commands. Threat actors like Kimsuky are known to use legitimate RMM tools like DWAgent to maintain persistent remote access while blending in with normal administrative activities.
Detects the execution of AnyDesk with flags intended to install it as a persistent service. Legitimate remote monitoring and management (RMM) tools like AnyDesk are increasingly weaponized by threat actors to establish robust, stealthy persistence that evades standard malware detection.
This is a KQL detection based on the YARA rules by Jason Baker of GuidePoint Security in linked reference - Connected to the Akira ransomware exploits
Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.
This rule identifies various indicators of Mimikatz execution, including specific command-line arguments, file names, suspicious access to the LSASS process memory, and the creation or loading of malicious services or DLLs associated with Mimikatz. It aims to detect credential dumping activities and persistence mechanisms often employed by attackers.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
Detects attempts to load kernel modules using common utilities like 'insmod', 'modprobe', or 'kmod'. This activity can be indicative of an attacker attempting to establish persistence, elevate privileges, or hide malicious activity by loading custom kernel modules.
This rule detects file creation, modification, or renaming events related to 'TieringEngineService.exe' in the 'C:\Windows\system32\' directory, or process execution of 'TieringEngineService.exe' running as the 'SYSTEM' account. This activity could indicate suspicious system-level operations or potential abuse of a legitimate Windows component.
This rule detects the loading of drivers that are known to be vulnerable, as listed in the LOLDrivers.io database. It correlates driver load events with a curated list of vulnerable driver hashes (SHA1 and SHA256) to identify potential Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.
This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
Detects the execution of sc.exe or reg.exe to create or modify specific Windows services to point to a malicious DLL. This technique is used by the Silver Dragon APT group to hijack legitimate services like 'bthsrv' and 'wuausrv' for persistence.
Detects the creation of a system service for NSecKrnl using sc.exe, indicating a potential Bring Your Own Vulnerable Driver (BYOVD) attack. Warlock has been observed utilizing the vulnerable NSecKrnl.sys driver to terminate kernel-level security products before deploying ransomware.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Detects the creation of a named object with the specific name 'MakeAmericaGreatAgain'. This string has been associated with various malware and potentially unwanted programs, often used as a mutex or other synchronization object to ensure only one instance of the malicious process is running.
Detects the creation of a Windows kernel service using sc.exe where the binary path points to common user-writable or temporary directories. This is a common TTP for Bring Your Own Vulnerable Driver (BYOVD) attacks, often used for privilege escalation and persistence.
Detects the creation of a new Windows service where the binary path points to suspicious, world-writable, or temporary directories. This is a common technique used in Bring Your Own Vulnerable Driver (BYOVD) attacks to load a malicious or vulnerable driver.
Detects execution of AnyDesk on Windows endpoints. Adversaries may use legitimate remote access tools to obtain interactive access and to maintain persistence after initial compromise.
Detects the creation of the 'UPlugPlay' Windows Service, a known persistence mechanism for the Prometei botnet. The malware may create the service using the command-line tool 'sc.exe' or directly via Windows APIs, which generates Event ID 7045.
Page 28 of 41